luna/enodia-sentinal
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Document current Sentinel project state

Browse source
This commit is contained in:
Luna 2026-06-13 06:46:33 -07:00
parent 6a09fbb7f9
commit 1f05923e0f
4 changed files with 73 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

13
docs/SPECIFICATION.md
View file

@ -43,7 +43,7 @@ The long-term product should combine six functions:
6. **Bash prototype remains the oracle.** The original shell implementation and
red-team harness preserve behavioral compatibility for core signatures.
## Current Scope: v0.8-dev
## Current Scope: Local IDS/IPS/EDR
### Poll Detectors
@ -100,9 +100,9 @@ When a fresh alert survives cooldown, Sentinel writes:
| Interface | Role |
|---|---|
| CLI | Run daemon, one-shot checks, baseline management, FIM checks, package DB checks, rootcheck, posture audit, incident review, triage, watchdog. |
| CLI | Run daemon, one-shot checks, baseline management, FIM checks, package DB checks, rootcheck, posture audit, incident review/export, triage, status/watchdog, and response planning. |
| Logs | Durable local evidence under `/var/log/enodia-sentinel`. |
| Dashboard | Read-only web view for status, alert browsing, and snapshot inspection. |
| Dashboard | HTTPS-only read-only web view for status, incidents, timelines, alert browsing, posture findings, event tail, and response-plan previews. |
| Push | ntfy, Pushover, and generic webhook notifications. |
| Red-team harness | Safe drills for testing signatures and demos. |
@ -111,6 +111,13 @@ reviewed dry-run plan under `response-plans/` and appends a JSONL
`response-audit.log` record. Dashboard/API previews remain read-only and do not
create artifacts.
Current IPS scope is explicit prevention workflow, not transparent inline
enforcement. Sentinel can recommend evidence preservation, process
freeze/termination, outbound IP blocks, systemd unit disablement, suspicious-file
quarantine, package-owner lookup, and follow-up verification. It does not
execute those commands until a future audited `--apply` workflow is designed,
tested, and documented.
## Target Scope: Host Security Platform
The next product shape should make Enodia useful before, during, and after an